Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content
Placeholder domain 'third-party[.]com' now serves malicious ClickFix lures.
The domain 'third-party[.]com', historically used as a placeholder in documentation and code, has been weaponized to serve malicious content. It now redirects Windows users to a ClickFix lure designed to execute PowerShell payloads, while macOS users see a fake security alert. This highlights the risk of using non-reserved domains as placeholders, as they can be registered by attackers.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Manifold Security?
Get an email when a new story names Manifold Security, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonDevelopers routinely used 'third-party[.]com' as a throwaway placeholder in documentation and code without verifying it was a reserved or controlled domain, leaving it open for a malicious actor to register and weaponize it. Once acquired, the attacker configured the domain to serve targeted payloads — ClickFix PowerShell lures for Windows users and fake security alerts for macOS users — exploiting the implicit trust that exists when a domain appears in widely-used repositories. This attack demonstrates that placeholder or example domains embedded in real codebases create a latent supply chain risk that can be triggered years later when an attacker registers the domain. The scale of 1,700+ affected repositories amplifies the blast radius, as any developer, CI/CD pipeline, or end-user system that resolves this domain is now exposed.
What helps against this
How we list vendors- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — third-party[.]com
- domain — your-domain[.]com
- domain — yoursite[.]com